Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 4 Mar 2015 10:42:08 +1100
From: Michael Samuel <>
Subject: PostgreSQL password hashing

Hi all,

I'm posting this to the list, since it seems to be making the rounds finally :)

The "pass the hash" flaw and weak password hashing scheme in
PostgreSQL was known to be weak at the time it was implemented.  I was
among a chorus of people who spoke out about it at the time of it's
inclusion, but the developers' response boiled down to:

This was recently rediscovered by atom from hashcat:

To protect yourself:
1) Put "password" instead of "md5" in pg_hba.conf
2) Use a randomly generated, unique password rather than an actual word.
3) Don't let attackers see your pg_shadow

The reason for (1) is that the password auth protocol doesn't accept
hashes.  Use TLS if network attacks are a problem.

The reason for (2) - which is a good idea anyway - is because the hash
in the database is is just md5(password username).  If the username is
"wordpress" for example, you could crack multiple hashes for similar
cost to cracking one.

(3) is a bit tongue-in-cheek, but pg_shadow is only accessible to
superusers, so don't connect your webapp as a database superuser and
you significantly reduce the risk of lots of bad stuff :)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.